Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add "hkcu\Software\VerbAce Research\VerbAce-Pro\RegInfo" /v data /t reg_binary /d 06536e96e8fc055e90c26926588a02f0205257b7e81a1592ac001d4a81aee00e4072add6173ac09e31029c6607ca692ec192c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688ba2f58acd226557fbcdd1b0058ade20d4d6894d51436479bcfbc2065a5c9f73a5d94bae627668899ed211b70c4f3b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082f7e6524ad8ae2412b3760bda813edda23906a66a10ce7332849629fa9a5ef4c21426ab8a21ee9452f8b6511aba7e17e28746d4aa1d0ea47211d6713ada9e3902a7660cca6e2ec19238f6975afebe4c22a18631ea3c4ec4b25316ab7a21de7d42d9a6460ab06e13d26036b59a45fe7462fdc65b2ad08e29f29356f6ba4d1ec2822de6464af0ae5812b876a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee012b4c6b1da113e70a2d406386a9cce00326496c8fa2c5e7ec9f426588abcee205284b6e81a4c7eb0e2144678aadc0e9072a4d6093a49a5d7023466a6ca122e9892edf6255c69c5f7225486c6ea334e82b21416d27d2965a4be74a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee205284b6e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9cce00326496c8fa2c5e90c2f426588abcee20528db6c521537eb0e222468eaa140e6c722ad7 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\VerbAce Research\VerbAce-Pro\RegInfo" /v dictconf /t reg_binary /d 014172616269632d456e676c6973682044696374696f6e6172790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000001000000 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\gvac.sys" /v dat /t reg_binary /d e900e6b23297e8fc2d5e90c2f48990f0f01e53b8e7ed18517cb5e84845b9e60e5570a1d6a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f2245688baec1e5082b4e6184a7caee0124476a8da0c3e70a2d406386a9c416e96ddf8295e5e8ec1f23487ccbe2e534eb5f323e81a4c7eb0e2144678aadc0e4072a4d6083a6c9ed002346698cafc2e6092c4f6285a8cbef0225486b8ea1c4e80b2e416487aacde104274a6d80a3c6ea0d20436689accfe306294c6f82a5c8ec0f22495184268 /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Classes\gvac.sys" /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\Patch.bat""
- '<SYSTEM32>\taskkill.exe' /f /IM VerbAce-Pro.exe
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\VerbAce Research\VerbAce-Pro\RegInfo" /f
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\1.tmp\Patch.bat
Изменяет файл HOSTS.
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
